System and method for java deserialization vulnerability detection

Patent metadata

Field	Value
Publication number	US-11017094-B2
Application number	US-201815861310-A
Country	US
Kind code	B2
Filing date	Jan 3, 2018
Priority date	Jan 3, 2018
Publication date	May 25, 2021
Grant date	May 25, 2021

Abstract

A method for generating a deserialization vulnerability report of a Java project, includes: determining, by a computing device, if interior knowledge of the Java project is available, and when the interior knowledge of the Java project isn't available, performing a black box analysis to generate the deserialization vulnerability report; and when the interior knowledge of the Java project is available, determining by the computing device if source code of the Java project is accessible, when the source code of the Java project is accessible, performing a white box analysis to generate the deserialization vulnerability report, and when the source code of the Java project isn't accessible, performing a gray box analysis to generate the deserialization vulnerability report.

First claim

What is claimed is:

1. A method for generating a deserialization vulnerability report of a Java project, comprising:
determining, by a computing device, if interior knowledge of the Java project is available, and when the interior knowledge of the Java project isn't available, performing a black box analysis to generate the deserialization vulnerability report; and
when the interior knowledge of the Java project is available, determining by the computing device if source code of the Java project is accessible, when the source code of the Java project is accessible, performing a white box analysis to generate the deserialization vulnerability report, and when the source code of the Java project isn't accessible, performing a gray box analysis to generate the deserialization vulnerability report,
wherein the white box analysis is performed by:
analyzing the source code to obtain information of entry points;
scanning configuration files of the Java project to generate exploit payloads; and
executing the exploit payloads against the entry points to generate the deserialization vulnerability report; and

wherein the step of scanning the configuration files of the Java project to generate the exploit payloads comprises:
resolving the configuration files to obtain library files that the java program depends on;
scanning the library files and the source code to obtain gadgets that match with one from a gadget pattern database (DB); and
generating the exploit payloads using the obtained gadgets.

2. The method of claim 1 , wherein the step of analyzing the source code to obtain information of the entry points comprises:
collecting source information and sink information from the source code, wherein the source information comprises source entry points for accepting external data, and the sink information comprises sink points for performing deserialization;
performing taint analysis on the source information and the sink information to generate taint path between the source entry points and the sink points; and
parsing the taint path to extract the information of the entry points, wherein the information of the entry points comprises ways to feed data to the source entry points to intrigue the sink points.

3. The method of claim 2 , wherein the sink information comprises deserialization Application Programming Interface (API).

4. The method of claim 1 , wherein the gadget pattern DB comprises gadget patterns that cause risk in deserialization, and the gadget patterns comprises at least one of file write permission, code execution permission, Java reflection information, and open socket information.

5. The method of claim 1 , wherein the step of executing the exploit payloads against the entry points to generate the deserialization vulnerability report comprises:
determining relationship between the entry points and the exploit payloads to generate unit test cases for proof of concept (POC) test; and
executing the unit test cases under corresponding environment of the Java program to generate the deserialization vulnerability report.

6. The method of claim 1 , wherein the gray box analysis is performed by:
exploiting the Java project by forcing gadget payloads from a gadget payload database to an entry point specified in an entry point specification, and generating the deserialization vulnerability report based on the exploiting.

7. The method of claim 6 , wherein the exploiting is performed by a fuzzer.

8. The method of claim 1 , wherein the black box analysis comprises:
identifying a candidate Java service on a server, which is deemed as the Java project;
exploiting the candidate Java service by known gadget payloads from a gadget payload database; and
generating the deserialization vulnerability report based on the exploiting.

9. The method of claim 8 , wherein the exploiting is performed by a fuzzer.

10. The method of claim 8 , wherein the step of identifying the candidate Java service comprises:
scanning the server for open ports and service information; and
identifying a Java service running on one of the ports as the candidate Java service.

11. The method of claim 1 , further comprising accumulating the generated exploit payloads in a gadget payload DB.

Assignees

• Beijing Jingdong Shangke Information Technology Co Ltd
• Jd Com American Tech Corp

Inventors

• Wei Fengguo
• Lin Yueh-Hsun

Classifications

• G06F21/556

  involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755) · CPC title

• G06F21/562

  Static detection · CPC title

• G06F11/3612

  by runtime analysis (performance monitoring G06F11/3466) · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F11/3684

  for test design, e.g. generating new test cases · CPC title